You guys don’t just reset your password every time you log in to something you don’t use daily? They’ll never get my password if even I can’t remember it, moving target!
1Password has been my go to. It will autofill 2FA if I register it with 1PW. The sites that still send text and don’t allow authenticator apps still bug the shit out of me.
People in this thread: “Can you just let me log in please? Oh and please also make sure nothing happens to my account, I’m saving my credit card in here, ok? And when I place an order, just use the saved card, no need to ask me, thanks!”
I get that the UX sucks, I get that corpos shouldn’t require an account for meaningless use cases, but man if you’re logging into an actual application that you truly use, especially if there’s money or privacy involved - literally deal with it and wait for the next improvement to have better UX. People are trying to steal your shit and 2FA/Passkeys protect you.
Passwords can fuck right off. We’re done with those.
I have never ever had a card or login exploited due to my actions.
I have however, had several companies with increasingly insane login requirements “oopsie!” and leak my shit anyway
“Passkey already created for this device”
What really grinds my gears is that every goddamn login site now has separate pages for username and password, so the Autofill {Username}{Tab}{Password}{Enter} scheme doesn’t work anymore.
Now you have to wait an unpredictable amount of time until you can enter your password.
Also another quck vent if someone from my bank is reading this: Please explain to me why I always have to 2FA my browser login with my phone, but not the other way around? How tf is that safer when I can do anything solely on my phone anyway, which has no 2nd factor?
I hate that Microsoft/Google have 1 account for hundreds of services. I want a different account for each service but that requires logging out and back in multiple times.
Even worse:
Page 1: enter email or phone number
Page 2: enter password
Page 3: enter 2FA
okay, but why the fuck am I entering a password if you’re forcing me to use 2FA?
Corposluts: “iTs MoRe SeCuRe”
removed - If I can fucking reset my password with the same email/phone number I use to receive my 2FA, then the password is functionally useless
Well it wouldn’t be 2fa if you don’t use a password. Then it’s just 1fa.
(in case you didn’t know, 2fa stands for two-factor authentication, as in secondary authentication (usually besides a password))
Damn do I hate websites that do this. It’s always a gamble if Keepass can handle their stupid multi-page form correctly.
I tend to keep my ass in my pants, not always, butt usually.
this was the first time I read that as Keep ass
some fuckass website i’ll use thrice in my life: you NEED to add a passkey. for SECURITY. it’s IMPORTANT. DO IT!
my bank: heyyyy wanna do 2fa? it’s ok if u don’t… oh u do??? yaysies! ^w^ okay so. we can do sms or app notification :3
Don’t forget it starts off with only an ‘email’ field and only shows the password field after you fill that out and click a button, just to make sure that the login flow is as crap as possible for your password manager to deal with.
Those are really annoying. They sometimes cause trouble with autofill and it means jumping through 3 pages if 2FA is enabled.
That’s fine. There’s multiple reasons to do that, most notably SSO stuff.
The worst way of login:
Login with Google
Login with Facebook
Login with GitHubFollowed by the login that doesn’t let you use a password but sends you a mail with a link instead. Straight from hell.
Even worse. They automatically create an account if you don’t already have one through the login mechanism, so you get multiple accounts that can’t be merged.
you get multiple accounts that can’t be merged.
- microsoft
- github (owned by microsoft)
Huh? That’s a thing?
I coded a SSO like that where all you did was put in an email and put the code in in like 2nd year of work as a dev.
Is that seriously an issue where that can cause duplication on some platforms?!
No that’s weird to me. Even if you connect different social auths the platform should connect to the same email address
Click Log In, it leads to a new page where you choose Personal Account or Business Partner.
Click Personal, it takes you to a page with a Log In button.
Also:
- “Would you like to sign in with a Passskey?”
- Yes.
- “You don’t have a passkey!”
One site I used recently forced Passkey sign-on only, but when I tried to set one up on a second device, it said it would replace the first one! They’re meant to be per-device credentials!
I really hate when the login button is hard to find relative to the sign up button. It should be the other way around; you only sign up once, but you log in many times. It should be optimized for the more frequent task.
Why do you need a login button? You use a browser? Just download our app, it’s so convenient!*
*for us and our 398 advertising partners.
word, friendica used to be like this and I kept getting messages like “this user already exists” half the time I was trying to log in.
To me it’s always felt like a pretty blatant way to say they don’t give a shit about their existing users.
Users unfamiliar with the interface should get the big button.
“Stay signed in”, the biggest lie
You forgot the part where it shows your username on the profile link like you’re already logged in before they make you do all that bullshit.
2FA is a good thing. You don’t want it to go away.
Except when it’s just an email, or worse, a txt message, or worse, a whatsapp message, with no other option for using a proper 2fa generator…
But also, not every site needs 2fa, sometimes I really couldn’t care less if someone managed to hack into something, because I can just make a new account if that happened…
What really bugs me is that TOTP is objectively easier than any other form of 2fa. Just import the library, add the field on your login form, and you’re done.
- Email verification is annoying to code, it requires SMTP or an email gateway, is slow for the user, is risky from a security perspective, and to generate the code you probably still have to implement TOTP.
- SMS/RCS is even more annoying to code, it almost inevitably requires a third-party gateway, it can work differently if the user is in a different country or on a MVNO or in a low-signal area or just has the wrong astrological sign, is very slow for the end user, is almost useless from a security perspective, and you STILL have to implement TOTP.
- WhatsApp messages are somehow even more annoying to code than that, requires an api interaction with Meta (which is never fun and poorly documented), requires the end user to have an account with a specific third party, is slow for the end user, relies on another company’s security posture to determine your own, and you STILL have to implement TOTP.
- Making your own app for 2fa is undoubtedly the worst: not only is it annoying to code, it’s an ongoing annoyance that is strained through multiple app stores, adds an additional maintenance and support load, adds additional technical debt, adds an unnecessary attack vector, requires users to download another app, is often unreliable, is often pretty slow for the end user, is a total crapshoot from a security perspective, and guess what? YOU PROBABLY STILL HAVE TO IMPLEMENT TOTP.
Any company that chooses SMS or email verification over TOTP emphatically does not know what they’re doing.
2fa by email is probably slightly easier than TOTP, if the account verification via email is already implemented, but yeah, it’s not like it’s significantly easier…
That is a fair point. But again, you probably have to implement TOTP or something like it anyway, to generate the code.
You don’t have to implement totp for these alternatives… The “thing” about totp is that there’s a shared secret and a timestamp. Due to potential drift in clocks you need a window and period to know how many time steps to test, and how long each is.
But with an email/SMS/WhatsApp, there’s no shared secret. So you can simply send a random code, and store server side when it was generated. Totp makes no sense in that case.
Not that totp is difficult to implement at all. My implementation for work was what, less than 200 lines of C++ I think? I didn’t implement the sha1 myself though.
An earlier version of that comment said “something like TOTP,” but I guess I left that out while I was revising it. My point is you have to implement something that does most of what TOTP does anyway, so why not just use the version that’s already been stress tested?
My work 2fa can go away. I don’t give two shits if everything in the work app is printed in global papers, just stop making me go through a 5 step process to see my fucking roster.
I don’t think the 2FA is the issue this comic is attempting to convey.
Except that it needs another jump for autofill 2fa
I don’t want it for like 95% of the logins I have.
Seriously. Why would i care if someone logs into most of them. What are they going to do watch a movie on my Netflix account, play my kids roblox games, or change my crew on my Rockstar account? It’s unnecessary bs.
Any account that does payment (like your netflix one), will be used to test out stolen credit cards. This will in turn flag your account for fraud. You might not want that. Unless you do, I don’t know
What? Like they’d try and use a stolen credit card to pay for my service?
They won’t be paying, just tokenizing the cards to see if the data is good.
Sounds like it wouldn’t be a problem at all, for me, and really a problem for the police or netflix or the credit card company.
It will be a problem for you when the police decide it’s a civil issue (which they most likely will). Whether the credit card company will help you with this really depends on their policies, and I’m not sure what Netflix is supposed to do about it.
The bigger issue is gaining account details and personal info for identity theft.
Which also doesn’t matter anymore because companies sell our data all the time or just give it away through their own data insecurities. Or yanno, white pages. com and similar exists and its pretty easy to find anything about anyone anytime.
They don’t sell your ID or credit card information though, which is information a lot of these kinds of services have.
I don’t care. Likelihood is that’s not going to actually cause me anything but an annoyance anyway, so the cost of preventing it can’t be more annoying
Almost all sites should allow me to choose whether I want 2fac. And they shouldn’t prompt for it nearly as often as they do - some services do it for every login, most seem to do it every month at least.
I get the theory, but if it itself relies on some login-based service (like email) it becomes a kind of chicken and egg problem.
E-mail based 2fa isn’t good, but at least it’s better than having no 2nd factor at all.
Reminds me of all the times I’ve run into “Please provide another email address we can use to verify your signup for this email address.”
So I can’t have an email address unless I already have an email address. It’s the most asinine thing
Click login button -> Autofill username, password & totp token -> Done
(And staying signed in not working is an intentional side effect of deleting cookies and temp data on closing the browser…)
yes I do. I will take convivence over security most days. Just because you don’t, and you have good reasons to want it to stay, doesn’t mean everyone comes to the same conclusion based on similar data.
Although I personally think 2FA is very important in most cases, I agree that mandatory 2FA is annoying. If you want to forego security for convenience, that should be up to you. I’m sure you’re not stupid or ignorant of the risks.
Good thing you aren’t in charge of anything, then.
This is uterly idiotic but ok. I have decided I do not need to wear seat belt in the car. Just because you do and you have good reasons to want it to stay, doesn’t mean everyone comes to the same conclusion based on similar data.
there, now you are getting it.
i dont want you not wearing the seatbelt, it is so easy to do
we live in a society and im tired of paying for stupid doing stupid things
The day my taxes go towards paying for people who don’t have 2fa, we can discuss whether it should be mandatory. Also, comparing a compromised Netflix account to loss of life, really?
comparing cost to society
there is a reason ms forces updates now
As a user its annoying, as a developer it is incredibly frustrating and time consuming.
as a developer it is incredibly frustrating and time consuming
Huh? How? Implementing OTP (which I’m assuming most people here are talking about) is pretty trivial, and once you have it set up, it doesn’t require much maintenance.
It fails for somebody every day, it adds a dependency for a known unreliable 3rd party that often mangles the identification data it sends back, it is exploited by that 3rd party for extending their monopoly, and it gives that 3rd party (or any hacker that got access to them) full access to impersonate any user it wants.
What?
Implement TOTP and let your users use their preferred authenticator and none of what you’re struggling with will apply.
Oh, yeah, and of course there’s someone on the internet talking about the MFA protocol that no corporation uses.
That one is obligatory too.
(Anyway, yes, if you need MFA, use TOTP. That’s a non-brainier. Except that corporations don’t have brains.)
Which also means you can just copy/paste it alongside username and password with the same manager.
That’s the user’s choice, that should not be a consideration when choosing authentication methods as long as you tell them how to store it properly (in a reasonable way, probably shouldn’t mention keepass or anything like that).
👆️
